CVE-2019-25336

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

SpotAuditor 5.3.2 contains a local buffer overflow vulnerability in the Base64 Encrypted Password tool that allows attackers to execute arbitrary code by crafting a malicious payload. Attackers can generate a specially crafted Base64 encoded payload to trigger a Structured Exception Handler (SEH) overwrite and execute shellcode on the vulnerable system.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

VendorProductVersions
NsasoftNsauditor SpotAuditor5.3.2

References

Timeline

Published
Feb 12, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2019

CVE-2019-253379.8OwnCloud 8.1.8 contains a username enumeration vulnerability that allows remote attackers to discover user accounts by manipulating the sharCVE-2019-253385.3DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valCVE-2019-253397.5GHIA CamIP 1.2 for iOS contains a denial of service vulnerability in the password input field that allows attackers to crash the applicationCVE-2019-25347.1Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.CVE-2019-253407.5SpotAuditor 5.3.2 contains a denial of service vulnerability in its Base64 decryption feature that allows attackers to crash the applicationCVE-2019-253417.5iNetTools for iOS 8.20 contains a denial of service vulnerability in the Whois feature that allows attackers to crash the application by manCVE-2019-253427.5Centova Cast 3.2.12 contains a denial of service vulnerability that allows attackers to overwhelm the system by repeatedly calling the databCVE-2019-253437.8NextVPN 4.10 contains an insecure file permissions vulnerability that allows local users to modify executable files with full access rights.CVE-2019-253447.8Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executable files in the appCVE-2019-253457.8Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute aCVE-2019-253467.5TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'server_name' parameCVE-2019-253477.5thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username paramet